CVE-2026-121553 Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5microtime, allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then...